Home > Cyber insurance readiness > MFA explained
MULTI FACTOR AUTHENTICATION
A stolen password alone should never be enough to get in.
MFA explained: multi factor authentication in plain English
Multi factor authentication, or MFA, means signing in with your password plus a second proof, usually a tap on your phone or a short code. Most account takeovers start with a stolen or guessed password, and MFA stops most of them. Here is how it works and which kind to use.
✓ Email, remote access, accounting, banking★ The top question on insurance forms
The short answer
- MFA combines something you know (a password) with something you have (your phone or a security key) or something you are (a fingerprint).
- Even if a scammer steals the password, they cannot sign in without the second step.
- Authenticator apps with number matching, passkeys and security keys are strongest. Text message codes are better than nothing but the weakest option.
- Cyber insurers, HIPAA reviewers and banks now expect MFA on email, remote access and admin accounts.
- Never approve a sign in prompt you did not start. That is how MFA fatigue attacks work.
2 stepspassword plus proof
Secondsto approve a sign in
Strongestpasskeys and security keys
Weakesttext message codes
MFA methods compared
| Method | How it works | Strength |
|---|---|---|
| Security key or passkey | Tap a key or use your phone's fingerprint or face. Cannot be phished on a fake site. | Strongest |
| Authenticator app with number matching | Type the number shown on screen into your phone app | Strong |
| Authenticator app code | A six digit code that changes every 30 seconds | Good |
| Push approve or deny | Tap Approve on your phone | Good, but open to MFA fatigue |
| Text message or phone call | A code sent by text or voice | Weakest, can be stolen by SIM swap |
The tricks scammers use against MFA
🔔MFA fatigueDozens of sign in prompts until someone taps Approve just to make them stop.
📞Fake help desk call"This is IT, read me the code you just got." Real IT never asks for your code.
🎣Fake sign in pageA look-alike page captures your password and code in real time.
📱SIM swapA scammer moves your phone number to their phone to get your text codes.
Where to turn MFA on first
- Email, starting with owners, managers and anyone who handles money.
- Remote access: VPN, remote desktop and remote support tools.
- Admin accounts for Microsoft 365, Google, the firewall and servers.
- Banking, payroll, accounting and payment portals.
- EHR, practice management and any system with customer or patient data.
- Domain name and website hosting accounts.
How WENO rolls out MFA
1. Find every sign inEmail, remote access, admin and business apps.
2. Pick the methodAuthenticator apps with number matching, or security keys for high risk accounts.
3. Set it up with each personTen minutes per person, with backup methods so nobody gets locked out.
4. Cover remote accessMFA on the WatchGuard® VPN and remote tools, where insurers look first.
5. Train and documentStaff learn to deny prompts they did not start, and you get proof for your insurer. See cyber insurance questionnaire.
Questions people ask
What if someone loses their phone?
We set up a backup method for each person, and an admin can reset their MFA after confirming who they are.
Do staff have to use their personal phones?
Not necessarily. Security keys or company phones work too.
Is MFA required by law?
Some rules, such as the FTC Safeguards Rule for financial businesses, require it. Insurers and many contracts require it, and HHS has proposed making it clearly required under HIPAA.
Make stolen passwords useless.MFA on every account that matters, set up with your team.
Set up MFA for my officeSources
General information, not legal advice.